Why AzSK ARM Template Checker task are not giving complete security control results than AzSK SVT task?

Question

Am working on AzSK Secure DevOps with the help of Azure DevOps. In this, I configured AzSK ARM Template Checker task in my Azure DevOps organisation CI & CD definitions which is used for scanning and gave the security results of ARM Templates. But I have few doubts regarding these, there are:

1. Here, am used SQL Database ARM Template for AzSK ARM Checker task for scanning and its giving output also. But, it is giving only few security controls results (6 in count) as output. When am searching, I came to known that there are few more security controls for this SQL Database in this link.
2. Am done the same scanning with the AzSK SVT task which is done after deployed in the respective subscription, then it is giving more results (count) as output for the same resource than the AzSK ARM Template Checker output results (Count).
3. Why it is giving output in differently for the same SQL Database security controls based on the AzSK ARM Template Checker and AzSK SVT tasks?

Note: Not only for this resource, the same thing happening for the other azure resources like Storage, virtual network etc....

Am very thankful, if anyone give me suggestions for these doubts?

Answer 1

1. ARM Template checker covers Baseline controls only. For the list of controls that are currently scanned, you can refer ARMControls.json here. You can see that, for the "featureName": "SqlServer", there are currently 6 controls - which is the same as the count you're getting.
2. When using the SVT task for scan, all the controls that are enabled in the SQLDatabase.json under Services will be scanned. Hence, you're getting a higher number of controls in this case.
3. The reason for the difference in the number of controls scanned is explained in the points 1 & 2 above.

Same applies to the other Azure Resources as well.

Hope this helps!